CVE-2026-64371: proc: protect ptrace_may_access() with exec_update_lock (part 1)

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (part 1)

Fix the easy cases where procfs currently calls ptrace_may_access() without
exec_update_lock protection, where the fix is to simply add the extra lock
or use mm_access():

 - do_task_stat(): grab exec_update_lock
 - proc_pid_wchan(): grab exec_update_lock
 - proc_map_files_lookup(): use mm_access() instead of get_task_mm()
 - proc_map_files_readdir(): use mm_access() instead of get_task_mm()
 - proc_ns_get_link(): grab exec_update_lock
 - proc_ns_readlink(): grab exec_update_lock

The Linux kernel CVE team has assigned CVE-2026-64371 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 5.10.261 with commit ae1e630bcaac739f625822078edbaea98366930d
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 5.15.212 with commit d54f14655fd7d7b293698a8b6918563c4c0465e7
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 6.1.178 with commit bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 6.6.145 with commit 7456ae990a9738962b33146916fabca62ae3d4e0
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 6.12.97 with commit 4bfe8c481846cee52473a2f7d7b30ee8e6749fc4
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 6.18.40 with commit f9b4b03ccc9c69bf7f7298d4559906ebea7143b3
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 7.1.4 with commit c1cfd63326f5d09999134e9052c353faf738286e
	Issue introduced in 2.6.30 with commit f83ce3e6b02d5e48b3a43b001390e2b58820389d and fixed in 7.2-rc1 with commit 6650527444dadc63d84aa939d14ecba4fadb2f69
	Issue introduced in 2.6.27.23 with commit 6b06d6282100dd5aacf7d45443d651a1995bd9c4
	Issue introduced in 2.6.29.3 with commit 334ed22054b2ec8477e4409e214fc139cf937ef6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64371
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/proc/array.c
	fs/proc/base.c
	fs/proc/namespaces.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d
	https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7
	https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9
	https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0
	https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4
	https://git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3
	https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e
	https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69